topic Re: FMCv HA in Network Security

FMCv HA

Herald Sison — Mon, 13 Jun 2022 02:59:55 GMT

is there a way to setup 2 FMC with only 1 FTD device, This is to make sure that FMCv configurations will stay intact incase the other FMCv fails or the entire VMWare or hardware got corrupted?fmc, Cisco Firepower Management Center (FMC)fmc, Cisco Firepower Management Center (FMC)

Re: FMCv HA

Marius Gunnerud — Mon, 13 Jun 2022 04:11:19 GMT

Here is a guide for FMC HA configuration. And yes you can have two FMC that manage one FTD as long as they are configured as active / Standby

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/admin/710/management-center-admin-71/system-ha.html#id_21087

Re: FMCv HA

Mohammed al Baqari — Mon, 13 Jun 2022 09:38:19 GMT

Hi,

Just be aware about FMC HA is not automatic, i.e. if FMC-01 fails, you need
to manually switch roles to manage from FMC-02

**** please remember to rate useful posts

Re: FMCv HA

Massimo Baschieri — Mon, 13 Jun 2022 11:40:37 GMT

If you have only one ftd managed most probably you have FMCv 2 (licensed for two sensors only), which is not listed in the document linked by Marius, maybe it works anyway, but most probably you will not have tac support for that.

Re: FMCv HA

Herald Sison — Tue, 14 Jun 2022 08:27:45 GMT

does that mean you need to manually add the FTD to the FMC02?

Re: FMCv HA

Marius Gunnerud — Tue, 14 Jun 2022 13:31:04 GMT

No, configuration is "copied" from the active to the standby. but if the active fails you will need to promote the current standby FMC to active manually.

Re: FMCv HA

Herald Sison — Sat, 18 Jun 2022 02:46:35 GMT

Hi Sir,

one last thing. may i ask about the licenses for the 2nd FMC? i know i have +9999 licenses left for my FMCv but how will i assign it? will it be automatically be populated after joining the 2 FMC or will i need to create another token and add it to the second FMC?

Re: FMCv HA

Marius Gunnerud — Sun, 19 Jun 2022 22:04:47 GMT

I am not entirely sure which licenses you are refering to, could you post the full license name and PID?

Normally for FMCv you need entitlement licenses for each FTD device it will manage (as a minimum), that means if you have a high availability setup with two FTD devices you would still need 2 entitlement licenses. Then you would also need the additional licenses for IPS, URL, and file / malware depending on which of these you require.

If the licenses are in your smart account and are the correct license type for your FMCv then once you register your FMCv with the smart license account they will be consumed automatically.

Re: FMCv HA

Herald Sison — Mon, 20 Jun 2022 03:40:28 GMT

hi sir, this is now solved. after joining 2 FMCv's in HA mode the license for my FMCv just automatically populated and in license manager it consumes 2 FMCv licenses.